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!_.  INTRODUCTION 

This  report  covers  propress  in  message  technology,  including 
the  HERMES  Message  system,  performed  under  the  contract  "Message 
Technology  Research  and  Development"  for  the  period  2 April  1976 
through  2 July  1976. 

This  work  is  a continuation  of  work  on  MAILSYS/HERKES 
performed  under  the  ARFA  Contract  "Distributed  Computation  and 
TENEX  Related  Activities"  during  1975. 

The  work  leading  up  to  this  report  is  covered  in  the 
following  earlier  quarterly  progress  reports. 
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major  effort 

during 

the 

April 

-June 

period 

has 

been 

move  ahead  systematically  with  the  development  and  refinement  of 
MAI  LSYS/iiERMES  Version  2,  following  the  phased  development 
program  reported  in  OPR  No.  >\  (1  Aup  75  - 30  Oct  75)  listed- 
above  . 
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Version  ?.6  of  HERMES  was  implemented  and  given  limited 
release  during  this  period.  man  factors  evaluation  of  each 
successive  modification  to  HERMES  has  been  accomplished, 
suggestions  and  criticisms  from  the  community  of  HERMES  users 
have  been  solicited,  and  ; re  being  correlated  and  studied  to 
guide  the  design  of  the  present  and  future  versions  of  the  system. 


Documentation 


V/c  have  released  four  major  new  pieces  of  documentation:  two 
printed  manuals  "A  Tutorial  Introduction  to  HERMES"  and  the 
"HERMES  Users'  Guide",  and  two  on-line  interactive  programs 
"Help"  and  "Explain".  The  "Describe"  documentation,  which  has 
been  revised  to  reflect  changes  in  HERMES  ?.6,  can  be  used  as  an 
adjunct  to  "Explain". 


Improved  Message-Rending  Specifications 


Vie  have  greatly  improved  and  simplified  the  method  of 
specifying  sequence  arguments  for  message-reading  and 
message-handling  commands.  The  user  can  now  type  a filter 
whenever  HERMES  expects  a sequence,  and  HERMES  interprets  the 
specification  to  mean  "all  those  messages  that  pass  the  filter". 
All  specifications  that  depend  upon  an  attribute  of  the  messages, 
such  as  RECENT  and  SEEN,  are  now  filters. 
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HERMES  now  automatically  stores  each  sequence  specification 
as  it  is  used  in  a command.  This  "previous  sequence"  can  be 
input  again  when  the  next  sequence  specification  is  typed. 

New  Mpssnre-Crenti nr  Facilities 

The  new  command  named  EXPLODE  allows  the  user  to  transform 
an  incoming  message  stored  in  a message-file  into  outgoing 
message  ready  for  immediate  sending  or  for  further  editing.  New 
automatic  HERMES-croa ted  fields  arc  generated  corresponding  to 
the  new  sender  and  date. 

We  also  added  three  new  user-created  message  fields  of  the 
"date"  data -types. 

Improved  Control  Over;  System  Operation 

Four  new  Switches  have  been  added  to  give  the  user  greater 
control  over  the  way  the  system  operates.  Seven  other  switches 
have  been  changed  from  two-position  to  three-position 
( Ask -Yes -Ho  ) . 

Spell i nr  Correction  and  Message  Encryptor 

A new  version  of  the  spelling  corrector  is  installed.  Work 
has  begun  on  a message  encryptor. 
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Statistics  on  HERMES  Use 

An  automatic  statistics-fathering  mechanism  was  designed  and 
implemented  which  utilizes  easily  modified  probes  inserted  at 
selected  collection  points  in  the  HERMES  program.  The  statistics 
for  each  HERMES  session  are  recorded  in  a HERMES  message  sent  to 


a designated  network  address. 


Appli ca tions  Programming  Level  Security 

After  extended  exploration  of  security  designs,  we  produced 
a design  based  on  a security  kernal,  the  two-level  classif  ic  ation 
of  each  message,  and  a multi-level  terminal.  HERMES  provides 
four  simultaneous  jobs  multiplexed  through  a "trusted  job"  to  the 
terminal . 


Rapid  Changes  in  Security  Level 

Design  of  programs  and  strategy  to  allow  rapid  changes  in 
Security  level  was  undertaken.  This  work  included  study  of 
PMAPPING  the  HERMES  profile  and  index  files  so  that  the  HERMES 
profile  can  appear  as  a single  environment  containing  all 
information  from  the  current  ar.d  lower  security  levels. 

Monitor-Level  Security 

The  Encapsulator  system  was  completed.  The  initial  set  of 
AIM  security  enhancements  to  the  TENEX  monitor  was  checked  cut. 
The  seond  set  was  coded  except  for  a single  section. 
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The  Incoming  Message  Processor 

Work  was  begun  on  the  HERMES  incoming  message  processor, 
including:  (a)  design  and  partial  implementation  in  a scheme  for 
priority  messages,  (b)  technical  documentation,  (c)  design  of 
parsing  routines,  and  (d)  design  of  a translator  between  the 
incoming  message  format  (RIXT-128)  and  HERMES. 

DARPA/HA VY/CINCPAC  Test  Preparation 

The  Human  Factors  group  has  submitted  an  "Organization 
Impact  Study  Plan"  to  assess  the  effect  of  computer-based  message 
technology  on  he  Navy's  message-handling  opeations.  Human 
factors  personnel  have  continued  consulting  on  HERMES  design  and 
participated  in  plans  fo  the  DARPA/NA VY/CINCPAC  test. 
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IIj.  HERMES  VERSION  _2_J> 

We  created  HERMES  2.6  to  consolidate  improvements  and 
corrections  suggested  by  experience  with  earlier  versions. 

Active  participation  by  HERMES  users,  frequently  via  the 
improved  SUGGESTION  command  (introduced  in  Version  2.5),  has 
allowed  us  to  collect  a large  file  of  data  on  the  experiences  of 
HERMES  users.  We  are  presently  analyzing  this  material  and  we 
will  circulate  the  results  of  this  analysis  in  the  next  quarter. 
We  will  also  circulate  analyses  of  statistics  on  HERMES  use. 
(See  Section  III.)  These  will  be  useful  input  to  the  continuing 
Human  Factors  evaluation  of  HERMES. 

Also  planned  for  the  next  quarter  is  the  inclusion  in  HERMES 
of  an  encryptor,  which  can  be  used  to  produce  encrypted  messages 
containing  only  those  ASCII  characters  that  can  be  safely 
transmitted  by  the  network  MAILER  program. 

A_;_  Documentation 

Four  major  new  pieces  of  documentation  were  released  during 
the  current  quarter. 

1.  The  printed  manual  "A  Tutorial  Introduction  to  HERMES.",  by 
C.  L.  Haasmann  and  M.  C.  Grignetti.  This  is  a primer  for 
beginners  covering  only  the  basic  concepts  and  arranged  in  the 
form  of  lessons,  with  exercises  for  the  reader  and  review 
topics . 

2.  The  printed  manual  "HERMES  User’  Guide",  by  T.  H.  Myer  and 
C.  D.  Mooers,  6^  pages.  This  is  a basic  reference  covering 
all  aspects  of  HERMES. 
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3-  The  on-line  interactive  program  "Help",  a question-and-answer 
guide  to  user  documentation. 

ij.  The  on-line  interactive  program  "Explain",  a tree-structured, 
or  layered,  program  that  gives  a conceptual  map  of  the  entire 
system. 

In  addition,  the  "Describe"  documentation  has  been  revised 
to  reflect  changes  in  HERMES. 

Work  is  continuing  to  integrate  "Explain",  "Describe"  and 
the  ’"Users'  Guide"  into  a unified  structure  which  can  provide 
J 1 J si mation  on  as  general  or  detailed  a level  as  the  user 
desires . 


B . Improved  Message-Reading  Specification  . 

The  method  of  specifying  sequence  arguments  in 
message-reading  and  message-handling  commands  has  been  extended 
and  simplified.  If  a filter,  eitner  named  or  literal,  is  typed 
where  HERMES  expects  a sequence  (as  at  the  beginning  of  a 
sequence  argument),  HERMES  interprets  ihe  filter  r.o  mean  "all 
those  message  that  pa  ^ ' 

vr  ,mith  <cr> 

...its  all  messages  to  Smith,  where  "To:Smith"  is  a 
literal  filter. 

This  makes  it  no  longer  necessary  to  type  specifications  in 
the  form  of  "Print  VTo:  Smith"  (although  the  older  specification 
is  still  legal). 

In  addition,  all  system-defined  sequence  specifications 
based  upon  characteristics  of  the  messages,  such  as  RECENT  and 
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SEEN,  are  handled  in  a similar,  uniform  fashion.  It  is  now 
possible  to  type  sequence  specifications  such  as 


> S u r v e y SEEN /REG ENT <CR > 

Surveys  messages  that  are  both  SEEN  and  RECENT. 

>Survey  RECENT,  From:  Jones <CR> 

Surveys  all  RECENT  messages  plus  all  messages  from 
Jones . 

>List.  Subject:  Messages /OLE 'CFO 

Lists  all  messages  that  pass  the 
"Subject:  Messages",  i.e.,  that 

" M e s s a g e s " in  t h e tub  j e c t : - f i e 1. a , a n d 
fixed  filter  OLD. 

A new  system-supported  sequence  named  FRLVIOUSSEC'uENCE  has 

been  added  to  HERMES.  This  is  a named  sequence  consisting  of  the 

most  recent  sequence  that  the  user  has  specified  in  a command. 

>Survey  From:  Smith <GR> 

HEKEES  prints  a survey  of  all  rr.es sa pee  from  Smith, 
lot  us  suopo.se  7,  1-:1C,  2^  and  57. 

>Show  PRE  VI Cl'SSLC,  UP  CCU < C : > 

3,7,1^:16,23,57 

>List  PRFV1 OUSSECUFNCE  <CR > 

HERMES  lists  messages  3,  7,  1^:16,  23  and  57. 

A "companion"  to  PREVIOUSSEC'JEKCE  is  <CTRL-P>,  a new  control 

character.  <CTRL-F>  enters  the  PREVIGUSSECUENCE  as  a literal 

sequence  (and  as  a complete  sequence  argument),  and  prints  out 

the  message-nos.  in  the  <sequcnce>  position  of  the  command. 


> L i s t <CTRL-P>3,  7,  li!:  16  ,??,57<CR> 

HERMES  lists  messarcs  3,  7,  1^:16,  23  and  57. 

The  method  of  specifying  sequences  in  HERMES  is  now  under 

review  with  the  object  of  making  it  more  powerful  and  uniform. 


literal  filter 
have  the  word 
that  pass  the 
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C^  New  Message -Cron  ting  Facilities 


1.  A new  command  named  EXPLODE  dissects  an  incoming  message  and 
places  its  User-created  fields  in  the  corresponding  fields  of 
the  CBRAFT.  The  user  is  then  left  in  the  DRAFT-EDITOR  for 
further  editing.  EXPLODE  thus  turns  an  incoming  message  into 
an  outgoing  message.  Message-fields  generated  by  HERMES  are 
not  copied,  so  that  the  new  outgoing  message  receives  a new 
SENDER  field,  a new  DATE,  and  a new  MESSAGE-ID. 


2.  Three  new  message-fields  were  added  to  the  fields  of  the 
CDRAFT.  They  are  Start-Date:,  End-Date:  and  Suspense-Date:. 
All  are  user-created,  and  all  have  the  same  data-type  as  the 
DATE  field. 


>Start-Date:  <date><CR> 

where  date  is  expressed  as  day,  month  and  year,  in 
any  of  the  forms  acceptable  to  the  Date:-field  in  a 
filter . 


When  these  fields  are  used  in  filters,  they  take  the  same 
arguments  as  the  DATE  field:  On,  Before  and  After: 


>Survey  Start-Date:  On  <date><CR> 

>Print  Suspense-Date:  Before  <dateXCR> 
>List  End-Date:  After:  <dateXCR> 


D^  Improved  Control  Over  System  Opera ti on 


1.  Four  new  three-position  switches  were  installed. 


a)  STARTWITHINBOX  (Ask-Yes-No)  controls  whether  HERMES  Gets 
the  user's  Inbox,  MESSAGE . TXT ; 1 , when  the  user  enters  the 
system. 


-‘i-w  c. 
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b)  SAVEPAREE  ( A1 1 -Mcdiurn-Min  1 rr  u r: ) . When  the  user  creates  a 

file,  AFC. MEG; 1,  HERMES  automatically  creates  the  Index 
file  {ABC. MSG} ; 1 in  the  user's  directory.  SAVFPAPSE 

controls  how  much  "parse"  information  about  the  structure 
of  a messape-f ilc  is  saved  in  the  Index  file. 

c)  COM POSE-ERASE  ( Ask -Yes -No ) controls  whether  HERMES 
automatically  eraser  the  exist! np  text  in  the  CDRAFT  when 
the  user  pives  the  compand  COM I USE. 


d) 


TRANSMJT-NOW  ( Ask-Yes -Ho ( Cucur  ) ) 
calls  the  MAILER  proprerr  tc  trnr 
soon  as  the  user  pives  the  SEN! 
messape  is  placed  in  an  outroinr 


controls  whether  HERMES 
sri  t an  out  pci  nr  re  scare  as 
command,  cr  whether  the 
queue  to  wait  for  MAILER. 


*1 


2. 


A new  tempora 
the  user  to 
the  addressee 
BBN , it  is 
listed  in  the 
allows  BFN 
systems  as  if 
installinp  a 


ry  two-way  switch,  CHECK-LOCAL  (Yes-Nc),  allows 
turn  off  reecpni  tior.  of  local  addressees  unless 
name  is  extended  with  the  Escape-Key  <ESC>.  At 
now  no  Icnper  true  that  all  directory  names  are 
local  data  base  on  all  BEN  systems.  Ihic  switch 
users  to  type  the  names  of  PEN  users  on  other 
they  were  local.  It  is  a preliminary  to 
full  interface  with,  the  ferwardinp  database. 


3. 


Eipht  switches  have 
threc-poc i t ion  . All 
IN  IT  I A LSI)  R VKY  , T ILF.-P; 


been  chan  red  f rorr  two-position  to 
are  set  to  the  pattern  Ask -Yes -No: 
Lr.Tr!  (former  FILE),  MOVE-DELETE  (former 


MOVE),  COKPOSP -ERASE,  TEXT- POE  I-  A 'I  , FORMAT- JUSTIFY  (former 
FORMAT),  COM  POSE-SEN D , and  SEKD-ARCH I VE . 


i| . The  DFL.ETE-CONFIRM-Swi  tch  has  been  removed  as  unneeded 
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F\  Other  lmproyempn.tr. 


1.  Editing  the  KEFS AQF-PJL |,E  - R ECOR Dp  When  the  user  deletes  a 
message-fi le , using  the  TENEX  Exec,  and  then  uses  HERMES  to 
Edit  the  MESSAGI'-FILE-HECORD  in  the  Profile  to  remove  the 
record  of  the  message-file,  HERMES  automatically  deletes  the 
corresponding  Index  file. 


2.  Changes  to  the  Reply  Command 


a)  If  there  is  no  host  name  in  the  From: -field,  the  REPLY  command 
now  takes  the  default  host  name  from  the  Sender : -field . 


b)  The  REPLY  command  now  understands  attention  fields  in  the 

Sender:  and  From: -fields  of  incoming  messages  and  creates 

corresponding  addresses  (i.e.,  with  attention  fields)  in 
outgoing  messages. 

c)  The  Sub ject : -field  of  the  REPLY  command  now  consists  of  the 
Sub ject : -field  of  the  original  message  preceded  by  "Re:M.  The 
"Re:"s  do  not  iterate  when  the  REPLY  command  is  used  to  reply 
to  a reply. 

d)  The  REPLY  command  now  accepts  any  kind  of  sequence  as  long  as 
it  evaluates  to  precisely  one  message.  The  sequence  may 
contain  lists  and  ranges  of  message-nos.,  sequences,  and 
filters  in  any  combination.  It  is  still  not  possible  to  reply 
to  more  than  one  message  at  a time. 


a)  The  <CTRL-0>  character  now  performs  the  same  function  in 
HERMES  commands  as  <DEL>,  the  Delete  or  Rufcout  key.  Thus  the 
error-correcting  commands  in  text  input  and  in  HERMES  commands 
are  parallel : 


<CTRL-A>  Deletes  a single  letter  in  text. 

Deletes  a single  letter  in  a ilEJ-.MI-S  command  to  the 
beginning  of  a part  of  an  argument  in  a command:, 
e.g.,  a local  name  or  a host  name  in  an 
address-field,  or  a part  of  a TEREX  file-name. 

<CTHL-W>  Deletes  a word  in  text.. 

Deletes  an  argument  in  a command. 

<CTRL-C>  Deletes  a lino  In  text. 

Deleter  a complete  line  in  a command];  aborts  a 
command  before  the  final  <Ch>  is  typed. 


I 

l 


<DEL>  Rubou t key  or  Delete  key 

Has  the  same  effect  as  <CThL-C>  in  a command 
Has  no  effect  in  text. 

b)  If  <CTKL-C>  is  accidentally  typed,  the  user  can  now  recover  by 
typing  "Cent  inue<CR>"  to  the  TL'NEX  prompt.  "G".  If  the  user 
does  not  want  to  continue,  it  is  usually  advisable  to  type 
" Reset <CR > " . 

c)  The  <CTRL-K>  is  now  trapped  in  the  Text:-field,  so  that  if 


\ 


1 


J 

3 


3 


<CTRL-E>  is  accidentally  typc-d,  the  user  will  no  longer 
automatically  lose  the  text  that  has  been  typed.  HERMES  asks 
whether  the  text  should  be  erased,  and  thus  gives  the  user  a 
chance  to  recover. 

iirrECyod  Formatting^  The  Formatter  now  indents  paragraphs  the 
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same  number  of  spaces  are  typed  at  the  beginning  of  the 
paragraph.  The.1  r <CTRL-I>  (the  same  character  as  the  TAB  key) 
is  used,  the  formatter  Converts  it  to  an  indentation  of  8 
spaces . 


Elsewhere  in  text,,  the  Formatter  continues  to  treat  the 
<CTRL-I>  as  a word  separator.  Also  unchanged  is  the  use  of 
single  or  double  <CTRL-I>s  standing  alone  on  a line  to  switch 
the  Formatter  off  or  on. 


5.  Improved  Diapnosti os , 


a)  If  the  DELETE,  UNDELETE  or  MARK  commands  are  used  to  change 
the  status  of  a message,  and  the  message  already  has  that 
status,  HERMES  prints  a diagnostic. 


>Delete  7<CR> 

Message  7 is  already  marked  Deleted. 

c)  If  two  users  are  sharing  a message-file,  and  one  tries  to 
access  a file  while  the  other  has  the  file  open,  HERMES  gives 
the  diagnostic  "File  is  momentarily  busy.  Try  again?" 
Usually,  the  next  time  the  user  tries,  the  file  will  again  be 
free  . 

d)  The  diagnostic  "Help  called  ..."  has  been  replaced  by  the 
message  "Error  condition  ..."  followed  by  a diagnostic  tolling 
whether  the  user  can  continue  in  HERMES. 
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6.  Soo]  1 i nr  Corrector A new  exper  j non  l.a  1 version  of  the 
spell  in,"  corrector  for  HLI'T.ES  command and  objects  bar.  been 
ins  l a 1 led . 

7 . I mproved  Bdi  t.  orr.^ 

a)  Lists  and  rani'cn  of  numbers  are  now  accepted  in  the 
TEMi  LATE-l.LITOi: , the  MA1LSTA!  subcommand.? , and  the 

m t:  s s a o ! : - f 1 1 . e - r-:  !•  conn-  f d i to  h . 

> Fd i t MVTFtll  i.ATl'XCF.  > 

>>.8hew  P:6<C'.i,> 

>!1A  1 LSTA  T<C!;  > 

>>r-rint  ? , A < 0 h > 

>Edi  t Prof  i 1 e <(’H> 

> > f d 1 1 m r;  s s a n -fjl  k c o i . : , c k > 

> > > Do  1 e t e 1,3, r.  :7<Ch> 

b)  The  subcommands  of  the  HA  1 1. .ST  AT  command  have  beer  reworded  t.c 
make  them  clearer.  KAILS’!  AT  automatically  calls  the  KA1LSTAT 
subcommand?  when  undelivcrable  mossapes  exist. 

8.  A number  of  bups  have  been  fixed. 
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m.  statistics  on  iise 


Purine  the  current  quarter,  wo  have  designed  and  implemented 
an  autrn.nt.ic  s ta  t.  inti  es  mechanism  that:  monitors  HERMES  sessions, 
record  i up.  sipni  ficant  events  and  their  key  parameters. 
Initially,  the  statistics  mechanism  has  been  set  up  to  record 
such  .1  n Form  t i on  as  the  real  nr.d  CPI!  times-  at  the  ber.i  nriinp  and 
end  of  each  command  and  the  1 earth  of  each  res same  sent. 


Hessaoe  techno] cry  is  exploited  in  the  satieties  pathorinp. 
Events  occur i np  in  a.  HERE!  E session,  arc  packages  as  a messnpe  , 
addressed  to  a network  "nraildrop"  specified  by  the  HMdHS  version 
in  use.  Initially,  "stats  mess  a per."  from  all  i upper  ted  HEP.KES 
systems  arc  addressed  to  TGCAJ  hfbL'.MA . This  method  of  co! leetinp 
statistics  has  a nuhrer  of  ac!  van  tapes . Kecor'dinp  events  as  text 
makes  it  possible  to  inspect  the  dar.a  for  rensenat  loners  or 
perform  manual  analysis.  In  east  work  on  data  analysis,  we  have 
often  found  that  much,  of  sipnificanec  is  revealed  by  visual 
inspection.  Packapinr  each  session  as  a n.essape  allows  us  to  use 
the  full  power  of  HERMES  to  process  the  statisics  mossapr.s  . Vie 
can  sort  and  perform  selective  retrieval  cn  the  basis  cf  headers, 
and  extract  data  with  templates. 


A data  reduction  rrorrnm  is  beinp  implemented  at  Project 
HERMES  produces  weekly  analysis  based  on  approximately  1000 
session  records  per  week.  We  compute  the  real  time  used  per 
session,  the  "think  time",  i.e.,  the  time  HERMES  spends  idlinp 
durinp  a HERMES  session,  and  the  computer  time  (the  CPU  time  in 
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milliseconds),  the  number  of  addresses  per  message,  and  the 
message  length.  U'e  also  compute  the  average  number  of  times  each 
command  is  used  per  session  and  the  overape  amount  of  real  and 
CPU  time  used.  Results  of  these  analyses  v.’ill  be  reported  in  the 
next  Quarterly  Propress  Report. 

The  mechanism  underlying  the  statistics  pothering'  is  a group 
of  "probes".  Bach  probe  is  a orie-linc  BCPL  command  which  writ  cl- 
one lino  of  information  into  a specially  treated  file  in  the 
user's  directory.  The  information  consists  of  a label 
identifyinp  the  command  beinp  probed,  the  current  readings  of  t lie 
CPU  time  and  real  time,  and  other  optional  information  such  as 
the  length  of  the  message  beinp  sent  and  the  number  of 
addressees.  Typically,  a p^obe  is  inserted  at  the  beginning  and 
end  of  a command  or  a sipnificant  part  of  a command,  such  as  the 
computation  of  a sequence  of  messages. 


At  the  beginning  of  a session,  an  initializinp  command  sets 
up  the  file  and  inserts  HERMES  message  headers.  At  the  end  of 
the  session,  the  file  is  turned  into  a HERMES  message  and  sent  to 
the  specified  address. 


The  statistics  system  has  considerable  built-in  flexibility. 


1.  Probes  of  various  types  can  be  inserted  at  different  points 
in  HERMES  to  collect  different  kinds  of  data. 

2.  The  statistics  measures  from  different  versions  of  HERMES 
can  be  sent  to  different  collection  points. 

3.  Alternative  data  reduction  programs  can  be  prepared  for 
differing  data  analyses. 
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TABLE  1.  FORMAT  OF  A STATISTICS  MESSAGE 

Bate:  <dnte>  <ti  mo>-<:.',one> 

Subject:  Version  nurbor>  SI  a ti  st  ics 
F r o iv : I : K RMES  a t L b N - T E 1. 1 . X A 
To:  TSCAIK 

Mossape- J D:  <f  Choc  l cr-r  j ut.or>  ] < c!  n t e > <ti::;c>  . DERMKS> 

Initial  ,i::irr  data: 

BSYSn,  Cron.1  <CEl!  Vers  ion  Verification 

lime>,  t ir  c > , Nui;’h.r>,  Codc> 

Data  at  horinninm  and  end  of  parse  of  messape-f i 1 c : 

B GET  1 <rc»al  <CPU 

L’GLTI  timc>  liir.e> 

Data  at  berinninr  and  end  of  commands : 

Cconnand  <’rra]  <CFU 

symbol > tin  tirc> 

Da t a at  bepinninr  am'  end  of  sequence  process inp : 

BSEC  <real  <CPU 

ESEO  tii::c>  ti;;ie> 

Date  at  berinni  np  and  end  of  acscmblinp  mc-ssape  for  Send  in  r: 
BSND1 , <rea  1 <CI-U 

tirrc>  tinc> 

ESND1,  <rca 1 <CPU  <No.  of  O.'o.  of  CUMULI  or 

t i ii: o > , tin:e>  , Addrc  ssees  Characters>  IMMLDI 

E n d - o f - s e s s j.  o n d ala  : 

ESYSU , Crenl  CCPU 

timc>,  tirnc> 


NOTE:  Command  symbols  for  top-level  commando  _ first  four  letters 
of  command  name,  followed  by  "0,;. 


Special  cases:  LEO  = ,:<LF>" 

UFA NO  = 

SEMI  0 = 


ECMDO  = end  of  command 
CNTEO  = CTRL-E  interrupt 
CNTOO  = CTRL-0  interrupt 


Symbols  for  Draft-Editor  commands  = first  four  letters  of  command 
name  followed  by  "1",  and  are  indented. 

Special  cases:  ECMD1  = end  of  command 

CNTE1  v CTRL-E  interrupt 

CNT01  = CTRL-0  interrupt 
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Since  wr  collect  statistics  on  all  HERMES  users , we  believe  it  is 
important,  from  an  ethical  standpoint,  to  preserve  the  anonymity 
of  the  individual  users.  This  is  accomplished  by  limiting  the 
information  included  in  tne  message  generated.  An  inspection  of 
Table  1 and  Example  1 will  show  that  only  the  host  computer  and 
time  of  the  session  arc  revealed. 


.It  would  be  possible,  of  course,  for  a special  version  of 
HERMl-S  to  record  user  identity  in  these  r escapes  . We  would  hope 


that  this  wo  ■ ’v  be  done  with  the  informed  consent  of  the 

users  invol\ 


EXAMPLE  1.  A SAMPLE  MESSAGE 
Messape  ill;  502  chars  RECENT 

Mail  from  HBN-TENE XD  revd  at  20-.lu3-76  0154-EBT 
Date:  20  Jul  1976  01AS-EBT 
Subicct:  2.6.r  Statistics 
From:  HERMES  at  BEN-TENLXL* 

To:  TSCAIR  at  BBN A 

Messape-ID:  < [ B B 1 i - T E N E X D ] 2 0 - J u 1 - 7 6 01 : A 8 : 35 • HERMBS> 


BSYSO , 0,  163,  20605,  3713406515 
BGET1,  5,  1571 
EGET1,  8,  2562 
LF0,  15,  3536 
ECMD0 , 27,  1)563 
LEG,  3 ^ , 1)627 
ECMD0 , A 9 , 5^35 
REPLY0,  77,  5592 
BSEC1,  81,  5717 
ESE01,  81,  5738 
BSND1,  102,  6160 

ESND1,  121,  7609,  1,  275,  I MM ED I 
ECMD0 , 121,  7659 
QUITO,  122,  8056 
ESYS0 , 124,  8693 
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IV,  SECURITY  FOR  THE  DARPA/NAVY/CINCPAC  TEXT 
h-L.  Appl  i ca  tions-Levcl  Secnri  ty  : New  Design 

After  extended  exploration  of  designs  to  a.Licve  a single 
environment  within  HERMES  encompassing  different  security  levels, 
we  determined  that  this  approach  was  not  feasible. 

•In  preparation  for  the  Oahu  meeting,  May  1 0 — 1 3 > 1976,  we 
produced  a design  based  on  full  use  of  the  AIM  security 
enhancements,  a single-level  terminal,  and  uniform  classification 
for  all  parts  of  each  message.  In  this  design,  HERMES  was  to 
provide  four  simultaneous  jobs  at  different  . levels  of 
classf ication . 

After  the  Oahu  Meeting,  we  produced  a new  design  to  the 
following  specif ications : We  were  to  design  our  own  HERMES 
security  kernel;  there  was  to  be  a multi-level  terminal;  and 
user-level  jobs  would  be  multiplexed  through  a "trusted  job"  to 
the  terminal.  Work  is  proceding  on  the  details  of  the  new 
design  . 

B_i_  Appl  lent  .ions -Level  Security : Rapid  Changes  in  Security  Level 

Work  is  proceding  on  the  design  of  programs  and  stategy  to 
allow  rapid  changes  in  security  level.  We  have  undertaken  a 
study  of  PMAPPING  the  HERMES  Profile  and  Index  files  so  that  the 
HERMES  Profile  can  appear  to  the  user  as  a single  environment. 
Whatever  the  user's  current  security  level,  the  HERMES  profile 
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will  contain  all  information  from  current  and  lower  security 

, levels. 

!. 

i (L.  Moni  tor-Level  Security. 

i . 

a)  The  Encapsulator  system  was  completed. 

} 

b)  The  initial  set  of  AIM  security  enhancements  to  the  TEK'EX 

i 

monitor  was  checked  out.  The  second  set  of  AIM  security 
enhancements  was  coded,  except  for  the  JSYS  monitor  call 
GTJFN.  Work  on  GTJFN  has  been  partially  completed. 
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V.  THE  HERMES  INCOMING  MESSAGE  PROCESSOR 


Following  the  completion  of  the  LDMX/TENEX  protocols,  we 


have  begun  the  design  and  implementation  of  the  HERMES  incoming 


message  Processors. 


1)  We  have  designed  and  partially  implemented  a scheme  for 


handling  priority  messages. 


2)  We  have  produced  a preliminary  version  of  the  technical 


documentation  for  the  interface  of  the  HERMES  message  system 


with  the  LDMX. 


3)  We  have  conducted  a detailed  examination  of  the  content,  of 


messages  to  determine  how  to  parse  them  so  that  the  messages 


can  be  determined  to  be  correct  and  internally  consistent 


before  they  are  sent  to  the  LDMX. 


k ) Messages  coming  from  the  LDMX  will  be  in  the  form  RIXT-128. 


Messages  going  to  the  LDMX  will  have  the  form  of  a modified 


ACP-126.  We  have  begun  work  on  a translator  that  can  turn  the 


incoming  message  format  (RIXT-128)  into  a form  that  can  be 


used  in  HERMES. 
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VI.  HUMAN  FACTORS 


The  Human  Factor;  group  has  continued  consulting  on  HKRMES 
and  participated  in  HFRiiFS  design  moeotings. 


The  Human 

Factors 

group  has  submitted 

to 

NAVEL EX 

an 

"Organize tion 

Impact 

Study  Plan"  designed 

to 

assess 

the 

organization  irr 

pa o t o f 

the  use  of  computer 

-has 

ed  rres; 

sage 

technology  on  I.'avy  message-hand!  i ng  operations. 


The  long-range  plan  oonk ampin  t es  building,  a model  so  that 
the  impact  on  an  organisation  can  be  predicted  from  knowledge  of 

a)  the  system  to  be  used. 

b)  the  state  of  the  organisation. 

c)  how  the  system  is  to  be  introduced  into  the  crganizti.cn. 

The  short-term  objectives  for  the  calendar  year  1976  include 
a brief  literature  review,  and  an  informal  retrospective  study  of 
the  messape-sy stem  users  at  BEK'  and  elsewhere  on  the  AREA 
Network.  The  plan  also  includes  drafting  questions  on 
organisation  impact  which  MITRE  can  incorporate  into  its  plan  for 
the  DARPA /HA YY/CI NCPAC  test,  and  contemplates  an  advisory 
memorandum  on  strategies  for  introducing  the  system  at  CINCPAC. 
During  this  quarter,  we  have  compiled  a bibliography  and  begun 
the  review  of  the  literature. 


Human  factors  personnel  helped  prepare  the  Project  HERMES 
response  to  the  design  for  the  Oahu  Protocol  experiment, 
"Protocol  Analysis  Objectives"  by  John  Heafner.  We  commented 


22 


BBN  Report  No.  3357 


Bolt  Beranck  and  Newman  Inc 


e>:  per  i men  t 

would 

result  in 

a more 

not 

have 

t h e 

same  effect  of 

the 

sys  tern 

t ha  t. 

one  wou] d 

pet  by 

to 

sup  pee  t 

imp 

rovemon  ts 

before 

the  system  docipn  wan  locked  up. 


